GuardFrame ClickFix kit

A rogue plugin prepares the gate

GuardFrame is a rogue WordPress plugin captured under changing directory names. The page loads wp-security.js and defines an inline configuration object under a generated global name. It contains the remote content URL, its expected origin, the site's hostname and logo.

The script creates wp-security-root only when it is ready to open the lure. It generates a fresh 16-character token, adds a full-screen iframe with allow="clipboard-write", and sends the token, site details, logo and timestamp as query parameters. The page behind the frame must answer through postMessage from the configured origin with the same token. A ready message opens the overlay; heartbeat messages keep it active.

The captured framed page was TimberCheck, a fake verification flow with separate Windows and macOS commands.

The visitor is kept inside the frame

Once active, GuardFrame locks page scrolling. Escape and backdrop clicks do not dismiss it. The frame waits up to ten seconds for its handshake and requires continuing heartbeats. Empty or close messages remove it. After two failures, the script sets a randomly named cookie that suppresses another attempt for one hour.

A hidden Ctrl+Shift+Q shortcut provides a panic exit.

Security Guard hides its rivals

An inline component labelled "Security Guard" protects the overlay from other injected kits. It finds fixed elements with a z-index of at least 900, at least 90% of the viewport in both dimensions and visible content. It hides those elements and disables their pointer events while exempting wp-security-root and nodes marked data-og-self.

The guard runs at startup and then every three seconds for 30 seconds. Comments in the captured build record a change from a one-second interval. A mutation observer also restores GuardFrame's own shell if another script removes or moves it. 53 GuardFrame sites also carry BranchHop.

What we see

Month	New sites
September	14
October	48
November so far	7

100% of GuardFrame sites captured since 25 September run WordPress.

Finding the plugin and its guard

Check the logged-out page, plugin inventory and served assets for:

• wp-security.js in an unfamiliar plugin directory
• wp-security-root, data-og-self or __overlayGate
• an iframe with allow="clipboard-write" and og_token parameters
• token-and-origin checks inside a message listener
• heartbeat, failure-count and one-hour suppression logic
• code measuring fixed elements against 90% of the viewport
• a mutation observer that restores a removed full-screen shell

Remove the rogue plugin, then purge WordPress, optimisation and CDN caches. Recapture the page after the one-hour suppression cookie is cleared.